Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2025-70981 SQL Injection Vulnerability in CordysCRM 1.4.1 Employee List Query Interface https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-70981
Post summary
The text reports the discovery of a SQL injection flaw (CVE-2025-70981) affecting CordysCRM 1.4.1's Employee List Query Interface.
CVE-2025-70981 CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter. https://www.cve.org/CVERecord?id=CVE-2025-70981
Post summary
CVE-2025-70981 exposes a SQL Injection flaw in CordysCRM 1.4.1’s /user/list endpoint via the departmentIds parameter, as detailed in the CVE record.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fit2cloud | cordys_crm | 1.4.1 | - | - |